Which of the following Trojans does not use TCP protocol?

Back Orifice, a remote administration tool released by the Cult of the Dead Cow, is distinguished by its default use of the User Datagram Protocol (UDP) for communication. The original version operates over UDP port 31337. This choice of a connectionless protocol made its traffic potentially harder to detect and trace compared to connection-oriented protocols. While its successor, Back Orifice 2000, added TCP support, the original and most widely known version is fundamentally UDP-based. The other Trojans listed—Beast, NetBus, and Donald Dick—all primarily utilize the Transmission Control Protocol (TCP) to establish reliable command and control (C2) channels with the attacker.

A. Donald Dick: This is a less common but known Trojan that uses TCP for its C2 communications, often on a specific, non-standard port.
B. Beast: This is a well-known Remote Administration Trojan (RAT) written in Delphi that uses TCP to establish its connection, by default on port 6666.
D. NetBus: NetBus is a classic Trojan that operates over TCP, using default ports such as 12345 to grant an attacker remote control over a system. ---

1. Crosbie

M.

& Granneman

B. (1998). An analysis of the Back Orifice remote administration tool (CSD-TR-98-09). COAST Laboratory

Purdue University. Retrieved from https://www.cerias.purdue.edu/assets/pdf/bibtexarchive/CSD-TR-98-09.pdf.

Page 3

Section 3.1: "Back Orifice uses the User Datagram Protocol (UDP) for all its network communications. The default port for the server to listen on is 31337."

2. Grimes

R. A. (2001). Malicious Mobile Code: Virus Protection for Windows. O'Reilly Media

Inc.

Chapter 10

NetBus Section: "NetBus is a client/server program that allows one computer to control another over a network connection using the TCP/IP protocol... By default

NetBus uses TCP port 12345."

Chapter 10

Back Orifice Section: "Unlike NetBus

which uses TCP

BO uses the User Datagram Protocol (UDP)."

3. Skoudis

E.

& Zeltser

L. (2003). Malware: Fighting Malicious Code. Prentice Hall PTR.

Chapter 4

Trojan Horse Case Study: NetBus and Back Orifice: This chapter contrasts the two Trojans

noting NetBus's use of TCP for reliable sessions and Back Orifice's use of the "unreliable

but speedy" UDP protocol.

4. Nazario

J. (2004). Defense and Detection Strategies against Internet Worms. Artech House.

Page 119: The text describes the Beast Trojan

noting its client-server architecture which communicates over TCP/IP

with a default port of 6666.